Skip to content

Instantly share code, notes, and snippets.

@kunigami

kunigami/pseudo_meltdown.c

Last active Apr 23, 2020
Embed
What would you like to do?
#include <setjmp.h>
#include <signal.h>
#include <stdio.h>
#include <string.h>
void primer(char probe[256]) {
// Some specific address
int addr = 136322;
// This will throw segmentation fault, but we're "catching it"
char v = *(char *)addr;
// This will be executed spectulatively by the CPU
probe[v] = 1;
}
sigjmp_buf point;
// segfault signal handling
static void handler(int sig, siginfo_t *dont_care, void *dont_care_either) {
longjmp(point, 1);
}
int main() {
struct sigaction sa;
memset(&sa, 0, sizeof(sigaction));
sigemptyset(&sa.sa_mask);
sa.sa_flags = SA_NODEFER;
sa.sa_sigaction = handler;
sigaction(SIGSEGV, &sa, NULL);
char probe[256];
if (setjmp(point) == 0) {
primer(probe);
} else {
printf("Read chunks of probe and check which one is cached\n");
}
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.